Electronic device and method for detecting abnormal device operation

ABSTRACT

An electronic device and a method for detecting abnormal device operation are provided. The method includes: obtaining multiple action events of a movable input device, and each action event including a relative coordinate and a time stamp of the movable input device; generating multiple absolute coordinates based on the relative coordinate of each action event; estimating multiple speed vectors based on the absolute coordinates and the time stamp of each action event; estimating multiple acceleration vectors based on the speed vectors and the time stamp of each action event; and estimating a probability of abnormal operation based on the speed vectors and the acceleration vectors.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims the priority benefit of Taiwan applicationserial no. 109146618, filed on Dec. 29, 2020. The entirety of theabove-mentioned patent application is hereby incorporated by referenceherein and made a part of this specification.

BACKGROUND Technical Field

The disclosure relates to a mechanism for detecting device operation,and more particularly to an electronic device and a method for detectingabnormal device operation.

Description of Related Art

In the online game industry as of today, it is common for players toteam up and compete with each other. However, in competitive games,skills learnt by the players from practice are usually tested. In thiscase, obtaining an improper advantage with additional hardware andsoftware assistance is often one of the important factors that destroythe healthy competitive environment in a game. Therefore, if it ispossible to detect and find the players using the above manner to playthe game in time, the fairness of the game may be better guaranteed.

Generally speaking, most of the players using the above manner to playthe game proceed with the assistance of auxiliary operation script tools(hereinafter referred to as scripts). From the system level perspective,the scripts may be roughly divided into two levels: software level andfirmware level.

In the software-level approach, the scripts run on the operating systemof a gaming device (such as a computer) in the form of a program. On theother hand, in the firmware-level approach, the players or other relatedpersonnel may configure the scripts in the firmware of a hardware device(such as a mouse device) to directly output signals to the gamingdevice.

Existing anti-cheat software systems, such as valve anti-cheat (VAC) andBattleEye, may actively detect tool software running in parallel withthe main game program, and the methods adopted thereby, for example,include scanning system threads, checking system file tampering andabnormal network packets, etc. However, since the firmware-level scriptsdo not use any of the above methods, detection through other ways isrequired.

SUMMARY

The disclosure provides an electronic device and a method for detectingabnormal device operation, which may be used to solve the abovetechnical issues.

The disclosure provides a method for detecting abnormal deviceoperation, which is suitable for an electronic device connected to amovable input device. The method includes the following steps. Actiondata of the movable input device is obtained. The action data includesmultiple action events, and each action event includes a relativecoordinate and a time stamp of the movable input device. Multipleabsolute coordinates corresponding to the action data are generatedbased on the relative coordinate of each action event. Multiple speedvectors corresponding to the action data are estimated based on theabsolute coordinates and the time stamp of each action event. Multipleacceleration vectors corresponding to the action data are estimatedbased on the speed vectors and the time stamp of each action event. Aprobability of the action data corresponding to abnormal operation isestimated based on the speed vectors and the acceleration vectors.

The disclosure provides an electronic device, which includes a storagecircuit and a processor. The storage circuit stores a program code. Theprocessor is coupled to the storage circuit and loads the program codeto execute the following steps. Action data of a movable input device isobtained. The action data includes multiple action events, and eachaction event includes a relative coordinate and a time stamp of themovable input device. Multiple absolute coordinates corresponding to theaction data are generated based on the relative coordinate of eachaction event. Multiple speed vectors corresponding to the action dataare estimated based on the absolute coordinates and the time stamp ofeach action event. Multiple acceleration vectors corresponding to theaction data are estimated based on the speed vectors and the time stampof each action event. A probability of the action data corresponding toabnormal operation is estimated based on the speed vectors and theacceleration vectors.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of an electronic device and a movableinput device according to an embodiment of the disclosure.

FIG. 2 is a flowchart of a method for detecting abnormal deviceoperation according to an embodiment of the disclosure.

DETAILED DESCRIPTION OF DISCLOSED EMBODIMENTS

Please refer to FIG. 1 , which is a schematic diagram of an electronicdevice and a movable input device according to an embodiment of thedisclosure. In different embodiments, an electronic device 100 is, forexample, various devices, such as a computer device and various smartdevices, that may be used to run a game, but not limited thereto. Asshown in FIG. 1 , the electronic device 100 may be connected to amovable input device 199. The movable input device 199 is, for example,any input device, such as a mouse device or other similar handhelddevices, that allows the user to control/operate the game in a mobilemanner, but not limited thereto. For ease of description, the mousedevice will be used as an example of the movable input device 199 below,but is not intended to limit the possible implementation of thedisclosure. In other embodiments, the designer may choose any inputdevice capable of reporting coordinates to implement the movable inputdevice 199.

In FIG. 1 , the electronic device 100 may include a storage circuit 101,a display 102, and a processor 104. The storage circuit 101 is, forexample, any type of fixed or removable random access memory (RAM),read-only memory (ROM), flash memory, hard disk, other similar devices,or a combination of these devices, and may be used to record multipleprogram codes or modules. The display 102 is, for example, a screen thatmay be used to display/present the screen/content of the game.

The processor 104 is coupled to the storage circuit 101 and the display102, and may be a general-purpose processor, a specific-purposeprocessor, a traditional processor, a digital signal processor, multiplemicroprocessors, one or more microprocessors, controllers,microcontrollers, application specific integrated circuit (ASIC), andfield programmable gate array (FPGA) combined with a digital signalprocessor core, any other type of integrated circuit, state machine,processor based on advanced RISC machine (ARM), and the like.

In the embodiment of the disclosure, the processor 104 may access themodules and program codes recorded in the storage circuit 101 toimplement the method for detecting abnormal device operation provided bythe disclosure, and the details are as follows.

Please refer to FIG. 2 , which is a flowchart of a method for detectingabnormal device operation according to an embodiment of the disclosure.The method of this embodiment may be executed by the electronic device100 in FIG. 1 , and the details of each step in FIG. 2 will be describedbelow in conjunction with the elements shown in FIG. 1 .

First, in Step S210, the processor 104 may obtain action data MD of themovable input device 199. The action data MD may include multiple actionevents E₁ to E_(N) (where N is the number of action events), and eachaction event E₁ to E_(N) may include a relative coordinate, a timestamp, and an event type of the movable input device 199.

In the embodiment of the disclosure, in the case where the movable inputdevice 199 is assumed to be a mouse device, the action data MD is, forexample, session data of the mouse device, and the action events E₁ toE_(N) included thereby is, for example, multiple mouse events of themouse device.

In the embodiment of the disclosure, the processor 104 may, for example,obtain a preset number (that is, N) of consecutive action events from anoperating system of the electronic device 100 to form the action data MDof the movable input device 199, but not limited thereto. In anembodiment, when the processor 104 detects that an action eventcorresponding to a button pressing operation (such as pressing the leftbutton) on the mouse device, the processor 104 obtains N consecutiveaction events including the action event to form the action data MD ofthe movable input device 199.

In other embodiments, the processor 104 may also detect that the mousedevice has an action event corresponding to a button pressing operation,and form the action event and subsequent (N−1) consecutive action eventsas the action data MD of the movable input device 199, but not limitedthereto. In this case, the action event corresponding to the buttonpressing operation may be understood as a first action event in theaction data, but not limited thereto.

For ease of description, it is assumed that N is 7 below, and the Nconsecutive action events obtained by the processor 104 may have thecontent illustrated in Table 1 below.

TABLE 1 Relative Action event coordinate Event type Time stamp (ms) 1(342, 897) Pressing left button 74015 2 (339, 897) Moving 74016 3 (334,897) Moving 74018 4 (333, 899) Moving 74019 5 (326, 899) Moving 74021 6(324, 900) Moving 74022 7 (319, 900) Other 74023

In the context of Table 1, the relative coordinate of each action eventis, for example, a current cursor position of a mouse cursor of themovable input device 199 in the display 102 of the electronic device100. For example, it is assumed that the resolution of the display 102is 1920×1080 and the coordinate of the upper left corner of the display102 is (0, 0). In this case, the coordinate of a cursor positioncorresponding to an action event 1 (that is, the first action event) inthe display 102 is, for example, (342, 897); the coordinate of a cursorposition corresponding to an action event 2 (that is, a second actionevent) in the display 102 is, for example, (339, 897); and thecoordinate of a cursor position corresponding to an action event 3 (thatis, a third action event) in the display 102 is, for example, (334,897). The coordinates of cursor positions of the remaining action eventsin the display 102 may be deduced based on the above teaching, and willnot be described here.

After that, in Step S220, the processor 104 may generate multipleabsolute coordinates corresponding to the action data MD based on therelative coordinate of each action event. In an embodiment, theprocessor 104 may, for example, set a first absolute coordinate amongthe absolute coordinates to (0, 0) or other required coordinate values,but not limited thereto.

In an embodiment, during the process of obtaining an (i+1)-th absolutecoordinate (where 1≤i≤N−1) among the absolute coordinates, the processor104 may, for example, subtract the relative coordinate of the i-thaction event from the relative coordinate of the (i+1)-th action event,and add the i-th absolute coordinate among the absolute coordinates togenerate the (i+1)-th absolute coordinate.

For example, when i is 1, the processor 104 may, for example, subtractthe relative coordinate of the first (that is, i-th) action event fromthe relative coordinate of the second (that is, (i+1)-th) action event,and add the first (that is, i-th) absolute coordinate among the absolutecoordinates to generate a second (that is, (i+1)-th) absolutecoordinate. Taking Table 1 as an example, the processor 104 may, forexample, subtract the relative coordinate (that is, (342, 897)) of theaction event 1 from the relative coordinate (that is, (339, 897)) of theaction event 2, and add the first absolute coordinate (that is, (0, 0))to obtain (−3, 0) as the second absolute coordinate.

For another example, when i is 2, the processor 104 may, for example,subtract the relative coordinate of the second (that is, i-th) actionevent from the relative coordinate of the third (that is, (i+1)-th)action event, and add the second (that is, i-th) absolute coordinateamong the absolute coordinates to generate a third (that is, (i+1)-th)absolute coordinate. Taking Table 1 as an example, the processor 104may, for example, subtract the relative coordinate (that is, (349, 897))of the action event 2 from the relative coordinate (that is, (334, 897))of the action event 3, and add the second absolute coordinate (that is,(−3, 0)) to obtain (−8, 0) as the third absolute coordinate.

In addition, when i is 3, the processor 104 may, for example, subtractthe relative coordinate of the third (that is, i-th) action event fromthe relative coordinate of a fourth (that is, (i+1)-th) action event,and add the third (that is, i-th) absolute coordinates among theabsolute coordinates to generate a fourth (that is, (i+1)-th) absolutecoordinate.

Taking Table 1 as an example, the processor 104 may, for example,subtract the relative coordinate (that is, (334, 897)) of the actionevent 3 from the relative coordinate (that is, (333, 899)) of an actionevent 4, and add the fourth absolute coordinate (that is, (−8, 0)) toobtain (−9, 2) as the third absolute coordinate.

For other values of i, the processor 104 may obtain the correspondingabsolute coordinate based on the above teaching, as shown in Table 2below.

TABLE 2 Absolute coordinate index value Absolute coordinate 1  (0, 0) 2(−3, 0) 3 (−8, 0) 4 (−9, 2) 5 (−16, 2)  6 (−18, 3)  7 (−23, 3) 

After that, in Step S230, the processor 104 may estimate multiple speedvectors corresponding to the action data MD based on the absolutecoordinates and the time stamp of each action event.

In an embodiment, the processor 104 may set a first speed vector amongthe speed vectors to (0, 0) or other required vectors, but not limitedthereto.

In other embodiments, when 1≤i≤N−1, the processor 104 may subtract thetime stamp of the i-th action event from the time stamp of the (i+1)-thaction event to generate the i-th time difference value among multipletime difference values. After that, the processor 104 may subtract thei-th absolute coordinate from the (i+1)-th absolute coordinate togenerate the i-th coordinate difference value among multiple coordinatedifference values, and divide the i-th coordinate difference value bythe i-th time difference value to generate the (i+1)-th speed vectoramong the speed vectors.

For example, when i is 1, the processor 104 may subtract the time stamp(that is, 74015 ms) of the first action event from the time stamp (thatis, 74016 ms) of the second action event to generate a first timedifference value (that is, 1 ms) among the time difference values. Afterthat, the processor 104 may subtract the first absolute coordinate (thatis, (0, 0)) from the second absolute coordinate (that is, (−3, 0)) togenerate a first coordinate difference value (that is, (−3, 0)) amongthe coordinate difference values, and divide the first coordinatedifference value by the first time difference value to generate a secondspeed vector (that is, (−3, 0)) among the speed vectors.

When i is 2, the processor 104 may subtract the time stamp (that is,74016 ms) of the second action event from the time stamp (that is, 74018ms) of the third action event to generate a second time difference value(that is, 2 ms) among the time difference values. After that, theprocessor 104 may subtract the second absolute coordinate (that is, (−3,0)) from the third absolute coordinate (that is, (−8, 0)) to generate asecond coordinate difference value (that is, (−5, 0)) among thecoordinate difference values, and divide the second coordinatedifference value by the second time difference value to generate a thirdspeed vector (that is, (−2.5, 0)) among the speed vectors.

When i is 3, the processor 104 may subtract the time stamp (that is,74018 ms) of the third action event from the time stamp (that is, 74019ms) of the fourth action event to generate a third time difference value(that is, 1 ms) among the time difference values. After that, theprocessor 104 may subtract the third absolute coordinate (that is, (−8,0)) from the fourth absolute coordinate (that is, (−9, 2)) to generate athird coordinate difference value (that is, (−1, 2)) among thecoordinate difference values, and divide the third coordinate differencevalue by the third time difference value to generate a fourth speedvector (that is, (−1, 2)) among the speed vectors.

For other values of i, the processor 104 may obtain the correspondingspeed vector based on the above teaching, as shown in Table 3 below.

TABLE 3 Absolute coordinate index value Absolute coordinate Speed vector1  (0, 0)    (0, 0) 2 (−3, 0) (−3.0, 0) 3 (−8, 0) (−2.5, 0) 4 (−9, 2) (−1.0, 2.0) 5 (−16, 2)  (−3.5, 0) 6 (−18, 3)  (−2.0, 1) 7 (−23, 3) (−5.0, 0)

Thereafter, in Step S240, the processor 104 may estimate multipleacceleration values corresponding to the action data MD based on thespeed values and the time stamp of each action event.

In an embodiment, the processor 104 may set a first acceleration vectoramong the acceleration vectors to (0, 0) or other required vectors, butnot limited thereto.

In other embodiments, when 1≤i≤N−1, the processor 104 may subtract thei-th speed vector from the (i+1)-th speed vector to generate the i-thspeed difference value among the speed difference values. After that,the processor 104 may divide the i-th speed difference value by the i-thtime difference value to generate the (i+1)-th acceleration vector amongthe acceleration vectors.

For example, when i is 1, the processor 104 may subtract the first speedvector (that is, (0, 0)) from the second speed vector (that is, (−3.0,0)) to generate a first speed difference value (that is, (−3.0, 0))among the speed difference values. After that, the processor 104 maydivide the first speed difference value by the first time differencevalue (that is, 1 ms) to generate a second acceleration vector (that is,(−3.0, 0)) among the acceleration vectors.

For another example, when i is 2, the processor 104 may subtract thesecond speed vector (that is, (−3.0, 0)) from the third speed vector(that is, (−2.5, 0)) to generate a second speed difference value (thatis, (0.5, 0)) among the speed difference values. After that, theprocessor 104 may divide the second speed difference value by the secondtime difference value (that is, 2 ms) to generate a third accelerationvector (that is, (0.25, 0)) among the acceleration vectors.

When i is 3, the processor 104 may subtract the third speed vector (thatis, (−2.5, 0)) from the fourth speed vector (that is, (−1.0, 2.0)) togenerate a third speed difference value (that is, (1.5, 2.0)) among thespeed difference values. After that, the processor 104 may divide thethird speed difference value by the third time difference value (thatis, 1 ms) to generate a fourth acceleration vector (that is, (1.5, 2.0))among the acceleration vectors.

For other values of i, the processor 104 may obtain the correspondingacceleration vector based on the above teaching, as shown in Table 4below.

TABLE 4 Absolute coordinate Absolute Speed Acceleration index valuecoordinate vector vector 1  (0, 0)    (0, 0) (0, 0) 2 (−3, 0) (−3.0, 0)(−3.0, 0)    3 (−8, 0) (−2.5, 0) (0.25, 0)   4 (−9, 2)  (−1.0, 2.0)(1.5, 2.0) 5 (−16, 2)  (−3.5, 0) (−1.25, −1.0)  6 (−18, 3)  (−2.0, 1)(1.5, 1.0) 7 (−23, 3)  (−5.0, 0) (−3.0, −1.0)

Then, in Step S250, the processor 104 may estimate a probability of theaction data MD corresponding to abnormal operation based on the speedvalues and the acceleration values.

In an embodiment, the processor 104 may input the speed values and theacceleration values into a pretrained machine learning model. Themachine learning model may output the probability of the action data MDcorresponding to the abnormal operation in response to the speed valuesand the acceleration values. In different embodiments, the machinelearning model may be implemented by adopting a model, such as a longshort term memory (LSTM) model, a hidden Markov model (HMM), a recurrentneural network (RNN), or an attention-based neural network, but notlimited thereto.

During the pretraining process of the machine learning model, theprocessor 104 may, for example, obtain historical action data (which mayinclude N consecutive historical action events) corresponding toabnormal operation of the movable input device 199, which is convertedinto multiple corresponding historical speed vectors and historicalacceleration vectors by the operations taught in Steps S220 to S240.After that, the processor 104 may input the historical speed vectors andthe historical acceleration vectors as training data into the machinelearning model, so that the machine learning model predicts aprobability of the historical action data corresponding to the abnormaloperation accordingly. After that, the processor 104 may determine theprediction accuracy of the machine learning model based on the predictedprobability, thereby updating various parameters of the machine learningmodel accordingly.

After repeating the above process, the probability of the abnormaloperation predicted by the machine learning model should graduallybecome more accurate.

Therefore, when the processor 104 inputs the speed values and theacceleration values in Table 4 into the machine learning model in StepS250, the probability of the action data MD corresponding to theabnormal operation predicted by the machine learning model may be usedas reference for game management personnel or other related personnel.In this way, the game management personnel may effectively grasp whichmobile devices used by the players may have scripts configured in thefirmware, thereby maintaining the fairness of the game.

In summary, the embodiments of the disclosure may obtain the speedvectors and the acceleration vectors corresponding to the action dataaccordingly after collecting the action data including the actionevents, thereby predicting the probability of the abnormal operation onthe movable input device through the neural network. In this way, thegame management personnel may effectively grasp which mobile devicesused by the players may have scripts configured in the firmware, therebybetter maintaining the fairness of the game.

Although the disclosure has been disclosed in the above embodiments, theembodiments are not intended to limit the disclosure. Persons skilled inthe art may make some changes and modifications without departing fromthe spirit and scope of the disclosure. The protection scope of thedisclosure shall be determined by the scope of the appended claims.

What is claimed is:
 1. A method for detecting abnormal device operation,suitable for an electronic device connected to a movable input device,the method comprising: obtaining action data of the movable inputdevice, wherein the action data comprises a plurality of action events,and each of the action events comprises a relative coordinate and a timestamp of the movable input device; generating a plurality of absolutecoordinates corresponding to the action data based on the relativecoordinate of each of the action events; estimating a plurality of speedvectors corresponding to the action data based on the absolutecoordinates and the time stamp of each of the action events; estimatinga plurality of acceleration vectors corresponding to the action databased on the speed vectors and the time stamp of each of the actionevents; and estimating a probability of the action data corresponding toabnormal operation based on the speed vectors and the accelerationvectors.
 2. The method according to claim 1, wherein the movable inputdevice comprises a mouse device, each of the action events furthercomprises an event type, and the event type corresponding to an i-thaction event among the action events comprises a button pressingoperation of the mouse device.
 3. The method according to claim 2,wherein i is
 1. 4. The method according to claim 2, wherein theelectronic device comprises a display, and the relative coordinate ofeach of the action events corresponds to a cursor position of a mousecursor on the display.
 5. The method according to claim 1, wherein theaction events comprise an i-th action event and an (i+1)-th actionevent, 1≤i≤N−1, where N is a number of the action events, and the stepof generating the absolute coordinates corresponding to the action databased on the relative coordinate of each of the action events comprises:subtracting the relative coordinate of the i-th action event from therelative coordinate of the (i+1)-th action event, and add an i-thabsolute coordinate among the absolute coordinates to generate an(i+1)-th absolute coordinate among the absolute coordinates.
 6. Themethod according to claim 5, wherein an absolute coordinate of a firstaction event among the action events is (0, 0).
 7. The method accordingto claim 6, wherein a first speed vector among the speed vectors is (0,0).
 8. The method according to claim 1, wherein the action eventscomprise an i-th action event and an (i+1)-th action event, the absolutecoordinates comprise an i-th absolute coordinate and an (i+1)-thabsolute coordinate, 1≤i≤N−1, where N is a number of the action events,and the step of estimating the speed vectors corresponding to the actiondata based on the absolute coordinates and the time stamp of each of theaction events comprises: subtracting the time stamp of the i-th actionevent from the time stamp of the (i+1)-th action event to generate ani-th time difference value among a plurality of time difference values;subtracting the i-th absolute coordinate from the (i+1)-th absolutecoordinate to generate an i-th coordinate difference value among aplurality of coordinate difference values; and dividing the i-thcoordinate difference value by the i-th time difference value togenerate an (i+1)-th speed vector among the speed vectors.
 9. The methodaccording to claim 1, wherein the action events comprise an i-th actionevent and an (i+1)-th action event, the speed vectors comprise an i-thspeed vector and an (i+1)-th speed vector, 1≤i≤N−1, where N is a numberof the action events, and the step of estimating the accelerationvectors corresponding to the action data based on the speed vectors andthe time stamp of each of the action events comprises: subtracting thetime stamp of the i-th action event from the time stamp of the (i+1)-thaction event to generate an i-th time difference value among a pluralityof time difference values; subtracting the i-th speed vector from the(i+1)-th speed vector to generate an i-th speed difference value among aplurality of speed difference values; and dividing the i-th speeddifference value by the i-th time difference value to generate an(i+1)-th acceleration vector among the acceleration vectors.
 10. Themethod according to claim 9, wherein a first acceleration vector amongthe acceleration vectors is (0, 0).
 11. The method according to claim 1,wherein the step of estimating the probability of the action datacorresponding to the abnormal operation based on the speed vectors andthe acceleration vectors comprises: inputting the speed vectors and theacceleration vectors into a pretrained machine learning model, whereinthe machine learning model outputs the probability of the action datacorresponding to the abnormal operation in response to the speed vectorsand the acceleration vectors.
 12. The method according to claim 1,wherein the step of obtaining the action data of the movable inputdevice comprises: obtaining the action data of the movable input devicefrom an operating system of the electronic device.
 13. An electronicdevice, comprising: a storage circuit, storing a program code; and aprocessor, coupled to the storage circuit and loading the program codeto execute following steps of: obtaining action data of a movable inputdevice, wherein the action data comprises a plurality of action events,and each of the action events comprises a relative coordinate and a timestamp of the movable input device; generating a plurality of absolutecoordinates corresponding to the action data based on the relativecoordinate of each of the action events; estimating a plurality of speedvectors corresponding to the action data based on the absolutecoordinates and the time stamp of each of the action events; estimatinga plurality of acceleration vectors corresponding to the action databased on the speed vectors and the time stamp of each of the actionevents; and estimating a probability of the action data corresponding toabnormal operation based on the speed vectors and the accelerationvectors.
 14. The electronic device according to claim 13, wherein themovable input device comprises a mouse device, each of the action eventsfurther comprises an event type, and the event type corresponding to ani-th action event among the action events comprises a button pressingoperation of the mouse device.
 15. The electronic device according toclaim 13, wherein the electronic device comprises a display, and therelative coordinate of each of the action events corresponds to a cursorposition of a mouse cursor on the display.
 16. The electronic deviceaccording to claim 13, wherein the action events comprise an i-th actionevent and an (i+1)-th action event, 1≤i≤N−1, where N is a number of theaction events, and the processor performs: subtracting the relativecoordinate of the i-th action event from the relative coordinate of the(i+1)-th action event, and add an i-th absolute coordinate among theabsolute coordinates to generate an (i+1)-th absolute coordinate amongthe absolute coordinates.
 17. The electronic device according to claim13, wherein the action events comprise an i-th action event and an(i+1)-th action event, the absolute coordinates comprise an i-thabsolute coordinate and an (i+1)-th absolute coordinate, 1≤i≤N−1, whereN is a number of the action events, and the processor performs:subtracting the time stamp of the i-th action event from the time stampof the (i+1)-th action event to generate an i-th time difference valueamong a plurality of time difference values; subtracting the i-thabsolute coordinate from the (i+1)-th absolute coordinate to generate ani-th coordinate difference value among a plurality of coordinatedifference values; and dividing the i-th coordinate difference value bythe i-th time difference value to generate an (i+1)-th speed vectoramong the speed vectors.
 18. The electronic device according to claim13, wherein the action events comprise an i-th action event and an(i+1)-th action event, the speed vectors comprise an i-th speed vectorand an (i+1)-th speed vector, 1≤i≤N−1, where N is a number of the actionevents, and the processor performs: subtracting the time stamp of thei-th action event from the time stamp of the (i+1)-th action event togenerate an i-th time difference value among a plurality of timedifference values; subtracting the i-th speed vector from the (i+1)-thspeed vector to generate an i-th speed difference value among aplurality of speed difference values; and dividing the i-th speeddifference value by the i-th time difference value to generate an(i+1)-th acceleration vector among the acceleration vectors.
 19. Theelectronic device according to claim 13, wherein the processor performs:inputting the speed vectors and the acceleration vectors into apretrained machine learning model, wherein the machine learning modeloutputs the probability of the action data corresponding to the abnormaloperation in response to the speed vectors and the acceleration vectors.20. The electronic device according to claim 13, wherein the processorperforms: obtaining the action data of the movable input device from anoperating system of the electronic device.